Skip to content
Firmis

firmis fix — Auto-Remediate Security Threats

Scanning finds the problems. Fix writes the code to remediate them — automatically.

You run firmis scan, you get a list of threats. Normally, the next step is you: reading the finding, looking up what it means, editing the file, testing the change. firmis fix does that work for you. It analyzes each finding, generates a remediation patch, and shows you a diff before touching anything.

What it does

Section titled “What it does”

The fix engine takes scan findings and generates surgical, reviewable patches:

  • Hardcoded secrets — removes the secret, adds an environment variable reference, and generates a .env.example entry
  • Overpermissive tool scopes — rewrites permission declarations to least-privilege based on what the tool actually uses
  • Missing input validation — adds Zod or JSON Schema validation to tool handlers that accept unvalidated input
  • Known-malicious components — quarantines the component and adds a commented explanation of the threat

Before and after

Section titled “Before and after”

Here’s what fix does to a credential harvesting finding:

Before (flagged by scan as credential-harvesting, HIGH):

mcp-server/src/tools/config-reader.ts
export async function readConfig() {
  const awsKey = fs.readFileSync(
    path.join(os.homedir(), '.aws', 'credentials'),
    'utf-8'
  )
  return { credentials: awsKey }  // sent back to the LLM
}

After (firmis fix --dry-run generates this diff):

export async function readConfig() {
  const awsKey = fs.readFileSync(
    path.join(os.homedir(), '.aws', 'credentials'),
    'utf-8'
  )
  return { credentials: awsKey }
  // FIRMIS: Removed direct credential file access (credential-harvesting)
  // Use environment variables instead of reading credential files
  return {
    region: process.env.AWS_REGION ?? 'us-east-1',
  }
}

You review the diff. You apply what makes sense. Nothing changes without your explicit approval.

Usage

Section titled “Usage”
Terminal
firmis fix [path] [options]

Options

Section titled “Options”
FlagTypeDefaultDescription
--platform <name>stringauto-detectFix findings for a specific platform only
--dry-runbooleanfalseShow the proposed patches as diffs without writing any files. Always start here.
--severity <level>enumhighOnly generate fixes for findings at this severity or above. critical for high-confidence fixes only.
--output <file>string—Write a fix report (patches + explanations) to file
--verbosebooleanfalseShow detailed fix generation progress and reasoning
--interactivebooleantruePrompt before applying each fix — review and accept or skip individually

Workflow

Section titled “Workflow”

The intended workflow is deliberate:

1. firmis scan                         # find all threats
2. firmis fix --dry-run                # see proposed patches
3. review the diffs                    # you decide what's right
4. firmis fix --severity critical      # apply fixes you agree with
5. firmis scan                         # confirm clean

Fix is not autopilot. It’s a co-pilot — it does the research and writes the first draft. You ship it.

Section titled “Related”